New blog post: Hosting a Static Blog on FreeBSD with Bastille Jails
A deep dive into my self-hosting setup:
- FreeBSD 15.0 with securelevel 2
- Bastille jails for isolation (Caddy, Nginx, deployment gateway)
- PF firewall with strict NAT/RDR rules
- CI/CD via Forgejo Actions with rrsync-restricted deployments
- nullfs mounts for zero-copy file sharing between jails
The "transporter pattern" keeps the blog jail unexposed while enabling automated deploys. Jails remain the most elegant isolation mechanism around.